The vulnerability CVE-2025-23665 affects the RSV GMaps plugin (version <= 1.5) and is characterized as a Cross-Site Request Forgery (CSRF) that enables stored Cross-Site Scripting (XSS). This means that an attacker can trick an authenticated user into submitting a crafted request that results in malicious script being stored and executed in the context of the application. The CVSS 3.1 base score is 7.1, with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts on confidentiality, integrity, and availability all rated low. The vulnerability was published on 2025-01-16. No vendor advisory or patch links are available, and the product is not a cloud service.

Successful exploitation of this vulnerability can lead to stored XSS, which may allow attackers to execute arbitrary scripts in the context of the affected application, potentially compromising user data, session tokens, or performing unauthorized actions. The CSRF aspect means that attackers can induce authenticated users to perform these malicious actions without their consent. The combined impact affects confidentiality, integrity, and availability at a low level but is significant enough to warrant attention due to the stored XSS component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users of RSV GMaps should monitor for vendor updates. In the meantime, consider disabling or limiting use of the affected plugin version to reduce exposure. Avoid clicking on suspicious links that could trigger CSRF attacks and ensure that web application security controls such as anti-CSRF tokens and input sanitization are in place if possible.